I am checking the security of my Django application through a security scanner and I wonder if it useful to set the
X-Frame-Options DENY header on static assets like CSS, images or JS files?
I guess one may achieve to upload a HTML file disguised as something else (like an image) and still be served the same way, and then be able to execute JS on my domain (thus accessing some cookies). But it's not linked to being executed in an iframe so I can't see any attack vector this header would protect me from.
I already have the header set on the rest of my website (all the views handled by Django itself).